What is the OS X firewall for?

[jennyp]

Could someone explain, or point me to a resource that explains, what the OS X firewall is for, and how to set it up (and indeed, if I should bother setting it up)?

What are the threats that it is designed to mitigate? Does it have any annoying downsides?

I should say that I use filesharing over my home network to share files between my desktop iMac and my MBP, and sometimes to share screens, if that makes any difference.

 

[FreakinEurekan]

Do you have a router? If so, the firewall is mostly superfluous. Only really need it if your Mac has a public-facing IP address (i.e. it's plugged directly into an Internet modem with no router).

If you have a router, it has NAT that prevents any incoming traffic from ever getting to your Mac unless the connection is requested by the Mac.

 

[jennyp]

Yes I do have a router, so maybe the firewall isn't needed. Thanks.

 

[maflynn]

Yes I do have a router, so maybe the firewall isn't needed. Thanks.

Generally speaking its not needed, and there are other products like little snitch that offer a more robust firewall solution.

I have my firewall turned on because when I travel, I'm not behind my router, and if I'm using a public wifi.

 

[jonesea]

Don't assume that everything on the inside side of the router is friendly.

Use both.

 

[LV426]

Don't assume that everything on the inside side of the router is friendly.

Use both.

Agreed. For the minimal overhead that the OS X firewall adds, you have little to lose by enabling it. Unless your network administrator advises otherwise.

 

[chown33]

Use both.

Because if you ever take your computer out into the world, and use a wifi access-point at a public location (library, coffee shop, whatever), then your computer will be directly exposed to every other computer that's on that same wifi access-point.

And that could be anyone.

 

[jennyp]

So really I should enable it on my MacBook Pro? Is it enough just to turn it on?

 

[maflynn]

So really I should enable it on my MacBook Pro? Is it enough just to turn it on?

When I'm out and about, I make sure its on. Its pretty simple to enable so why not

 

[jennyp]

Thanks for the tips. Think I'll enable it on my mBP when I'm out and about. Might think of using a service like NetShade as well.